Trojan.Lechiket.4

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\services\usbhb] 'Start' = '00000002'

Malicious functions:

Executes the following:

'<SYSTEM32>\sc.exe' create usbhb binPath= <DRIVERS>\usbhb.sys type= kernel start= auto DisplayName= usbhb
'<SYSTEM32>\sc.exe' start usbhb
'<SYSTEM32>\wermgr.exe' -queuereporting
'<SYSTEM32>\sc.exe' stop usbhb
'<SYSTEM32>\conhost.exe'
'<SYSTEM32>\sc.exe' delete usbhb

Modifies file system :

Creates the following files:

\Device\HarddiskVolume1\Boot\BCD
\Device\HarddiskVolume1\Boot\BCD.LOG
<DRIVERS>\usbhb.sys

Network activity:

Connects to:

'jm###dxp.com':80
'of###sei.org':80
'ty###bdp.org':80
'ed###lbw.org':80
'vv###ywt.org':80
'jq###gqq.org':80
'yw###rdj.org':80
'vn###pvj.com':80
'fn###mhu.org':80
'nx###ylm.org':80
'js###hxn.com':80
'hb###pqm.com':80
'va###qaw.org':80
'jp###iub.org':80
'is###lic.org':80
'kk###esx.org':80
'vb###rog.org':80
'wv###bvh.org':80
'in###xip.org':80
'tu###rwr.org':80
'ay###vkg.com':80
'js###elr.org':80
'tu###uhw.com':80
'hs###bjm.org':80
'yi###bak.org':80
'wu###hbn.org':80
'om###uqw.com':80
'ih###als.org':80
'uw###iye.com':80
'tb###omg.org':80
'pv###dqs.org':80
'nb###pxq.org':80
'nw###tmw.com':80
'aw###gli.org':80
'pu###kmv.org':80
'hg###xfm.org':80
'gg###ago.org':80
'cd###chy.org':80
'fd###tky.org':80
'vu###vus.org':80
'kg###nqr.org':80
'bd###dtt.org':80
'wu###hjx.org':80
'jx###xsl.com':80
'qt###qup.org':80
'tm###esv.org':80
'oy###uvb.org':80
'mb###jmg.com':80
'nu###wrn.org':80
'aa###xlj.org':80
'gv###ivf.org':80
'ra###uik.com':80
'fi###bgm.org':80
'oy###lmp.com':80
'be###hwf.org':80
'bt###hqw.org':80
'tu###nnf.org':80
'de###qhb.org':80
'km###dkl.com':80
'pp###www.org':80
'ps###yun.org':80
'fo###vet.org':80
'sm###eml.org':80
'un###rpr.org':80
'ry###neo.org':80
'uf###cfc.org':80
'yq###xib.org':80
'ue###dec.org':80
'ua###hsi.com':80
'uo###dvh.com':80
'bf###qrp.org':80
'ge###qnx.org':80
'ax###qmm.com':80
'ga###bsk.com':80
'nn###nnr.org':80
'lh###wli.com':80
'bk###xxb.org':80
'km###vqf.org':80
'ya###csf.com':80
'li###ksw.com':80
'rs###tqf.org':80
'id###oph.org':80
'wp###gkg.org':80
'yk###cgu.com':80
'ge###agj.org':80
'sh###qpw.com':80
'rl###mfn.org':80
'lx###vud.org':80
'nh###wdh.com':80
'dh###yla.org':80
'th###eat.org':80
'rb###tgx.org':80
'vc###osq.org':80
'us###sem.org':80
'fi###mpv.com':80
'vm###ndv.org':80
'xe###ueg.org':80
'ni###rkp.org':80
'mg###ynr.org':80
'jq###ewl.org':80

TCP:

HTTP GET requests:

jm###dxp.com/srv.php?&i#########################
of###sei.org/srv.php?&i#########################
ty###bdp.org/srv.php?&i#########################
ed###lbw.org/srv.php?&i#########################
vv###ywt.org/srv.php?&i#########################
jq###gqq.org/srv.php?&i#########################
yw###rdj.org/srv.php?&i#########################
vn###pvj.com/srv.php?&i#########################
fn###mhu.org/srv.php?&i#########################
nx###ylm.org/srv.php?&i#########################
js###hxn.com/srv.php?&i#########################
hb###pqm.com/srv.php?&i#########################
va###qaw.org/srv.php?&i#########################
jp###iub.org/srv.php?&i#########################
is###lic.org/srv.php?&i#########################
kk###esx.org/srv.php?&i#########################
vb###rog.org/srv.php?&i#########################
wv###bvh.org/srv.php?&i#########################
in###xip.org/srv.php?&i#########################
tu###rwr.org/srv.php?&i#########################
ay###vkg.com/srv.php?&i#########################
js###elr.org/srv.php?&i#########################
tu###uhw.com/srv.php?&i#########################
hs###bjm.org/srv.php?&i#########################
yi###bak.org/srv.php?&i#########################
wu###hbn.org/srv.php?&i#########################
om###uqw.com/srv.php?&i#########################
ih###als.org/srv.php?&i#########################
uw###iye.com/srv.php?&i#########################
tb###omg.org/srv.php?&i#########################
pv###dqs.org/srv.php?&i#########################
nb###pxq.org/srv.php?&i#########################
nw###tmw.com/srv.php?&i#########################
aw###gli.org/srv.php?&i#########################
pu###kmv.org/srv.php?&i#########################
hg###xfm.org/srv.php?&i#########################
gg###ago.org/srv.php?&i#########################
cd###chy.org/srv.php?&i#########################
fd###tky.org/srv.php?&i#########################
vu###vus.org/srv.php?&i#########################
kg###nqr.org/srv.php?&i#########################
bd###dtt.org/srv.php?&i#########################
wu###hjx.org/srv.php?&i#########################
jx###xsl.com/srv.php?&i#########################
qt###qup.org/srv.php?&i#########################
tm###esv.org/srv.php?&i#########################
oy###uvb.org/srv.php?&i#########################
mb###jmg.com/srv.php?&i#########################
nu###wrn.org/srv.php?&i#########################
aa###xlj.org/srv.php?&i#########################
gv###ivf.org/srv.php?&i#########################
ra###uik.com/srv.php?&i#########################
fi###bgm.org/srv.php?&i#########################
oy###lmp.com/srv.php?&i#########################
be###hwf.org/srv.php?&i#########################
bt###hqw.org/srv.php?&i#########################
tu###nnf.org/srv.php?&i#########################
de###qhb.org/srv.php?&i#########################
km###dkl.com/srv.php?&i#########################
pp###www.org/srv.php?&i#########################
ps###yun.org/srv.php?&i#########################
fo###vet.org/srv.php?&i#########################
sm###eml.org/srv.php?&i#########################
un###rpr.org/srv.php?&i#########################
ry###neo.org/srv.php?&i#########################
uf###cfc.org/srv.php?&i#########################
yq###xib.org/srv.php?&i#########################
ue###dec.org/srv.php?&i#########################
ua###hsi.com/srv.php?&i#########################
uo###dvh.com/srv.php?&i#########################
bf###qrp.org/srv.php?&i#########################
ge###qnx.org/srv.php?&i#########################
ax###qmm.com/srv.php?&i#########################
ga###bsk.com/srv.php?&i#########################
nn###nnr.org/srv.php?&i#########################
lh###wli.com/srv.php?&i#########################
bk###xxb.org/srv.php?&i#########################
km###vqf.org/srv.php?&i#########################
ya###csf.com/srv.php?&i#########################
li###ksw.com/srv.php?&i#########################
rs###tqf.org/srv.php?&i#########################
id###oph.org/srv.php?&i#########################
wp###gkg.org/srv.php?&i#########################
yk###cgu.com/srv.php?&i#########################
ge###agj.org/srv.php?&i#########################
sh###qpw.com/srv.php?&i#########################
rl###mfn.org/srv.php?&i#########################
lx###vud.org/srv.php?&i#########################
nh###wdh.com/srv.php?&i#########################
dh###yla.org/srv.php?&i#########################
th###eat.org/srv.php?&i#########################
rb###tgx.org/srv.php?&i#########################
vc###osq.org/srv.php?&i#########################
us###sem.org/srv.php?&i#########################
fi###mpv.com/srv.php?&i#########################
vm###ndv.org/srv.php?&i#########################
xe###ueg.org/srv.php?&i#########################
ni###rkp.org/srv.php?&i#########################
mg###ynr.org/srv.php?&i#########################
jq###ewl.org/srv.php?&i#########################

UDP:

DNS ASK lh###wli.com
DNS ASK vu###vus.org
DNS ASK bk###xxb.org
DNS ASK rs###tqf.org
DNS ASK ya###csf.com
DNS ASK li###ksw.com
DNS ASK kg###nqr.org
DNS ASK jx###xsl.com
DNS ASK rl###mfn.org
DNS ASK id###oph.org
DNS ASK sh###qpw.com
DNS ASK km###vqf.org
DNS ASK fd###tky.org
DNS ASK ge###agj.org
DNS ASK qt###qup.org
DNS ASK mg###ynr.org
DNS ASK jq###ewl.org
DNS ASK ni###rkp.org
DNS ASK dh###yla.org
DNS ASK tm###esv.org
DNS ASK th###eat.org
DNS ASK xe###ueg.org
DNS ASK lx###vud.org
DNS ASK mb###jmg.com
DNS ASK nu###wrn.org
DNS ASK aa###xlj.org
DNS ASK fi###mpv.com
DNS ASK vm###ndv.org
DNS ASK wu###hjx.org
DNS ASK ay###vkg.com
DNS ASK js###elr.org
DNS ASK nx###ylm.org
DNS ASK js###hxn.com
DNS ASK hb###pqm.com
DNS ASK yi###bak.org
DNS ASK tu###rwr.org
DNS ASK jq###gqq.org
DNS ASK of###sei.org
DNS ASK jm###dxp.com
DNS ASK vv###ywt.org
DNS ASK va###qaw.org
DNS ASK ed###lbw.org
DNS ASK ty###bdp.org
DNS ASK wv###bvh.org
DNS ASK fn###mhu.org
DNS ASK in###xip.org
DNS ASK vb###rog.org
DNS ASK wp###gkg.org
DNS ASK yk###cgu.com
DNS ASK bd###dtt.org
DNS ASK yw###rdj.org
DNS ASK tu###uhw.com
DNS ASK hs###bjm.org
DNS ASK kk###esx.org
DNS ASK jp###iub.org
DNS ASK vn###pvj.com
DNS ASK is###lic.org
DNS ASK om###uqw.com
DNS ASK gv###ivf.org
DNS ASK uf###cfc.org
DNS ASK be###hwf.org
DNS ASK nb###pxq.org
DNS ASK bt###hqw.org
DNS ASK ry###neo.org
DNS ASK pp###www.org
DNS ASK nw###tmw.com
DNS ASK ra###uik.com
DNS ASK wu###hbn.org
DNS ASK fi###bgm.org
DNS ASK bf###qrp.org
DNS ASK gg###ago.org
DNS ASK ge###qnx.org
DNS ASK nn###nnr.org
DNS ASK uo###dvh.com
DNS ASK hg###xfm.org
DNS ASK oy###lmp.com
DNS ASK ax###qmm.com
DNS ASK ih###als.org
DNS ASK pu###kmv.org
DNS ASK ga###bsk.com
DNS ASK sm###eml.org
DNS ASK rb###tgx.org
DNS ASK ue###dec.org
DNS ASK km###dkl.com
DNS ASK uw###iye.com
DNS ASK aw###gli.org
DNS ASK cd###chy.org
DNS ASK nh###wdh.com
DNS ASK yq###xib.org
DNS ASK oy###uvb.org
DNS ASK vc###osq.org
DNS ASK us###sem.org
DNS ASK de###qhb.org
DNS ASK fo###vet.org
DNS ASK tb###omg.org
DNS ASK un###rpr.org
DNS ASK pv###dqs.org
DNS ASK ps###yun.org
DNS ASK tu###nnf.org
DNS ASK ua###hsi.com
'<Private IP address>':53380
'<Private IP address>':53397
'<Private IP address>':53410
'<Private IP address>':53382
'<Private IP address>':53409
'<Private IP address>':53379
'<Private IP address>':53408
'<Private IP address>':53381
'<Private IP address>':53383
'<Private IP address>':53411
'<Private IP address>':53407
'<Private IP address>':53392
'<Private IP address>':53393
'<Private IP address>':53401
'<Private IP address>':53402
'<Private IP address>':53391
'<Private IP address>':53400
'<Private IP address>':53398
'<Private IP address>':53396
'<Private IP address>':53395
'<Private IP address>':53394
'<Private IP address>':53399
'<Private IP address>':53386
'<Private IP address>':53405
'<Private IP address>':53406
'<Private IP address>':53384
'<Private IP address>':53385
'<Private IP address>':53387
'<Private IP address>':53403
'<Private IP address>':53390
'<Private IP address>':53389
'<Private IP address>':53404
'<Private IP address>':53388
'<Private IP address>':53378
'<Private IP address>':53334
'<Private IP address>':53333
'<Private IP address>':53336
'<Private IP address>':53335
'<Private IP address>':53330
'<Private IP address>':53329
'<Private IP address>':53332
'<Private IP address>':53331
'<Private IP address>':53342
'<Private IP address>':53341
'<Private IP address>':53344
'<Private IP address>':53343
'<Private IP address>':53338
'<Private IP address>':53337
'<Private IP address>':53340
'<Private IP address>':53339
'<Private IP address>':53328
'<Private IP address>':53317
'<Private IP address>':53316
'<Private IP address>':53319
'<Private IP address>':53318
'<Private IP address>':53313
'<Private IP address>':53312
'<Private IP address>':53315
'<Private IP address>':53314
'<Private IP address>':53325
'<Private IP address>':53324
'<Private IP address>':53327
'<Private IP address>':53326
'<Private IP address>':53321
'<Private IP address>':53320
'<Private IP address>':53323
'<Private IP address>':53322
'<Private IP address>':53367
'<Private IP address>':53366
'<Private IP address>':53369
'<Private IP address>':53368
'<Private IP address>':53363
'<Private IP address>':53362
'<Private IP address>':53365
'<Private IP address>':53364
'<Private IP address>':53375
'<Private IP address>':53374
'<Private IP address>':53377
'<Private IP address>':53376
'<Private IP address>':53371
'<Private IP address>':53370
'<Private IP address>':53373
'<Private IP address>':53372
'<Private IP address>':53361
'<Private IP address>':53350
'<Private IP address>':53349
'<Private IP address>':53352
'<Private IP address>':53351
'<Private IP address>':53346
'<Private IP address>':53345
'<Private IP address>':53348
'<Private IP address>':53347
'<Private IP address>':53358
'<Private IP address>':53357
'<Private IP address>':53360
'<Private IP address>':53359
'<Private IP address>':53354
'<Private IP address>':53353
'<Private IP address>':53356
'<Private IP address>':53355

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial